A858DE45F56D9BC9 archive

201309161459 1mioqv

explained decrypted filler

seed 875

Metadata

Post ID
1mioqv
Title
201309161459 → 2013-09-16 14:59 on A858's clock
Posted (UTC)
2013-09-16 18:59:55
Timezone
UTC−4 · title 14:59 against posted 18:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,040 hex characters · 520 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309161459) = 9551a8bd8ec313e53117aa6818186340 (name+title)
GUIDs
16
Filler GUID seed
new Random(875).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
98 · predicted N = 16 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
8 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

25A4B38BBCA7C5F4 C3F42C087A7DCB4E 2DBDAEF7C8AFF174 86856F93CBD5C921 C99FE84A1E09D0B5 213AAE6E38CD42E0 06B9CF64BC204227 8E0AE1ECE1DF5967 15EEBF2664DF6649 D802E9FDF7367E23 1A8B7F1E94B33D34 3EFD8C28C803C73D 0BFE01826952CC89 91229D5FF7A216FA 93556E6AE5E1EC97 A2BD10DB2F1E3A41 A328765C9002699F 76D32BBD57B50A82 8CB3476C0D124C09 37C12A8347C6645A FB5CCE8F6B8C0E07 D9FF10849A7C9464 9277D8FD9200C90D 4AA8247F866E98E4 ACF0A29F55351B00 1E49341B7F24EA0E D326B61CB347EA02 CCC10D0DEF113F62 727DC1F0F5D7F60F 30776B96D5E7DFF1 90EB293CD7291872 578E4BF11694AD1B F0F415CDC3A39105 5F75B4E2B3EBF586 1F9BED100963872E EF5A1F628CB2F8E5 ED947B62C4A6DD9C C058EC6807898856 EC37AC9C7782FF8C 9ABF3F369BB8A7F1 75CD1765A341FE96 79B169D67240B2D1 AE5F9BA310A4B457 A1F66E19BFA369CF 02DC24B9F2749D30 25012D507071CEDC C6C6D012C362C5F4 CDAC9025ECF88FFF 76CDB56F682B0B25 DCA60C4D7E9A024A 6F35BC66E097A4BE B26C8744BA06BEC8 1C0808BC3B80D482 6B55CA51B99A2B2F 6046615DD672C19C 6CD637DCC9F3A9EB BE2F2C85C06A456E F230F6B9914916D0 E8954289DF5BFFF4 72D07E094073F5B7 3C118DF94EF474B2 05A94E4CF0FC1E97 442FFBA93F052F97 576767F9631E7260 23AAE7E0C81A14EC
  • Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309161459 (name+title). Key = MD5(password) = 9551a8bd8ec313e53117aa6818186340, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 6c67e82e-ef47-7fe2-8d9b-e8536459f8b1
  2 936c858c-8b29-5a33-a0f2-a19de615ed8e
  3 132c9da4-d907-3ebe-a6da-bd6fb34839a4
  4 27160c3e-7fcc-24fe-af30-1de523739451
  5 8c626ecf-8dfc-2d7f-ac94-e752cf901286
  6 0a41842f-ab32-16ee-8ab7-ce2e3e0f4417
  7 e40eee2b-338a-8688-bea4-2473fbe38f80
  8 96c03b0b-8faf-3b13-af18-1d95dd78df72
  9 c907873b-483a-27e6-a0a6-8a5450ee6ab5
 10 3da8fdb2-a6e0-8f21-aac4-42f34854c56e
 11 6cf02878-b033-8308-afe3-6b6c7afb2f7e
 12 d54dbd39-d66e-56d7-ab7d-21082b1dc614
 13 9d1247de-abc3-1bf3-addb-53f0f84c39b3
 14 3f53f4f3-f813-68ac-bb86-ea932f3966ba
 15 d4fc4a80-5ae8-417e-8a57-bb983b106d23
 16 121a375a-bf5b-4007-82bf-2ae36a3d5965

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7532218328851644. Exactly this sequence comes out of new Random(875).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 98 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs